Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove ODCODC Ransomware and Restore .odcodc Files

odcodc-ransomware-skull-art-acsii-master-boot-record-dropbox-uniqueA ransomware that uses one of the most often used ransom messages, encrypting files with a strong cipher has been the reason for several reports of affected victims. The ODCODC ransomware (also known as crypto-virus) sets the .odcodc file extension to the newly encrypted files and leaves a “readthis.txt” ransom note. Users who have been infected with the ODCODC ransomware are advised to remove this ransomware immediately and try one of the file restoration methods illustrated after this article.

UPDATE! There has been a decryptor released for ODCODC Ransomware. You can download it from the following link

Threat Summary

Name ODCODC
Type Ransomware
Short Description The ransomware may encrypt files with the RSA-2048 cipher and asks a ransom payment for decryption.
Symptoms Files are encrypted and become inaccessible. A ransom note with instructions for paying the ransom shows as a readthis.txt file.
Distribution Method Spam Emails, Email Attachments, File Sharing Networks.
Detection Tool See If Your System Has Been Affected by ODCODC

Download

Malware Removal Tool

User Experience Join our forum to Discuss ODCODC Ransomware.

ODCODC Ransomware – How Is It Distributed

In order to be widespread, ODCODC Ransomware may use several different techniques to be spread out, but the main possibilities are:

Malicious files.
Malicious URLs.

Such may be spread in various ways, varying from malicious e-mail attachments to malicious URLs shared on various suspicious websites.

ODCODC Ransomware In Detail

Once activated on the computer, ODCODC ransomware may drop its payload files in one of the several folders:

  • %AppData%
  • %Temp%
  • %Roaming%
  • %User’s Profile Folder%
  • %Windows%
  • %Desktop%

The files may be more than one and may be of the following file formats:

→ .dll, .txt, .exe, .tmp, .vbs, .bat, .cmd

They may contain random names or names that resemble a Windows process, for example, “svchost.exe”. The .tmp files are usually dropped in the %Temp% folder.

After the malicious files have been dropped, the ODCODC ransomware may employ a powerful RSA or AES encryption to files with the following extensions:

After encrypting the files of affected users, ODCODC ransomware may delete the shadow volume copies of the infected computer, eradicating any possibility of files being recovered from backups. This can happen by executing a .vbs script with the following administrative command:

shadow-command-sensorstechforum

After this is done, the ransomware may create a “readthis.txt” file with the following ransom message:

→ “Your personal files are encrypted!
What happened to your files?
All of your files were protected by a strong encryption with RSA-2048. https://en.wikipedia.org/wiki/RSA_(cryptosystem)
What does this mean?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you cant restore them.
What to do?
We can recover your files. You can trust us, for proof of this we can decrypt some your files for free.
How to contact you?
Write us to email: abennaki@india.com
Ваши персональные файлы зашифрованы!
Что случилось с файлами?
Все ваши файлы зашищены криптостойким алгоритмом RSA-2048. https://en.wikipedia.org/wiki/RSA_(cryptosystem)
Что это значит?
Это значит, что структура и содержимое ваших файлов потерпили необратиме изменения, вы не можете с ними работать, читать или видеть, это тоже самое, что потерять их бесповоротно, но, с нашей помощью, вы можете их все восстановить.
Что мне делать?
Мы можем полностью восстановить доступ к вашим файлам. Вы можете нам доверять, доказать честность и серьезность наших намерений мы можем бесплатной расшифровкой нескольких файлов.
Как с вами связаться?
Напишите нам на почту: abennaki@india.com”Source:Affected Users

ODCODC Ransomware – Conclusion, Removal, and File Restoring

The bottom line for this variant of crypto-malware is that it may be part of the Rakhni or Troldesh variants. Judging by the badly written ransom note in Russian, it has been created for Russian users, but it may not originate from Russia. Such files may be decrypted via Rakhni decryptor by Kaspersky, which we have posted along with other file restoration methods in step “3. Restore files encrypted by ODCODC” below.

However, if you want to try and restore your files, we advise you to either do it on a safe computer or follow the removal instructions below to remove the malware from your PC. They are methodologically arranged to help detect and remove ODCODC ransomware effectively.

Finally, we advise you to follow this article for further updates on ODCODC ransomware and in the meantime to try the methods from step “3” below to attempt and restore your files. They may not be 100 percent successful, but there is a possibility that you might be able to revert at least some of your files.

Manually delete ODCODC from your computer

Note! Substantial notification about the ODCODC threat: Manual removal of ODCODC requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove ODCODC files and objects
2.Find malicious files created by ODCODC on your PC
3.Fix registry entries created by ODCODC on your PC

Automatically remove ODCODC by downloading an advanced anti-malware program

1. Remove ODCODC with SpyHunter Anti-Malware Tool
2. Back up your data to secure it against infections and file encryption by ODCODC in the future
3. Restore files encrypted by ODCODC
Optional: Using Alternative Anti-Malware Tools
Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.